For the first few years of the generative-AI boom, an uncomfortable amount of product strategy could be summarized as follows:
Take an impressive foundation model.
Put a pleasant interface around it.
Add a system prompt.
Charge $29 a month.
Put “AI-powered” on the homepage in a gradient font.
This worked surprisingly well.
It is also becoming a terrible strategy.
The problem is not that foundation models have stopped improving. Quite the opposite. They are improving so quickly that access to raw intelligence is becoming less scarce. According to Stanford’s [2026 AI Index] 2026 AI Index technical-performance data, four leading model providers were clustered within only 25 Elo points of one another on the Arena leaderboard by March 2026. Anthropic, xAI, Google, and OpenAI were all operating in roughly the same elite performance neighborhood.
Meanwhile, price-performance has collapsed. Stanford previously calculated that the cost of querying a model performing at roughly GPT-3.5 level fell from $20 per million tokens in November 2022 to $0.07 by October 2024—a more than 280-fold decrease. Stanford AI Index research on inference costs (Stanford HAI)
This does not mean models are literally commodities. Frontier differences still matter. Stanford found that the best closed model was 3.3% ahead of the best open model in March 2026, after the gap had narrowed dramatically in 2024. Certain models remain noticeably better at coding, reasoning, multimodal work, latency, or cost.
But the strategic question is not whether Model A beats Model B this Tuesday.
It is whether that advantage still belongs to you next Tuesday.
If your AI application’s primary advantage is “we use the smartest model,” your competitive advantage has the approximate shelf life of a ripe avocado.
The companies building genuinely defensible AI products are moving elsewhere. Their moats are emerging from proprietary learning loops, deeply accumulated context, workflow position, permissions, trust, distribution, and the ability to convert millions of interactions into a product that improves faster than competitors can copy it.
The foundation model matters.
It just increasingly isn’t the moat.
The first test: What happens if everyone gets your model tomorrow?
Product leaders should perform a brutally simple thought experiment.
Imagine that tomorrow morning every competitor receives access to the exact same model you use, at the exact same price, with roughly the same latency.
What remains?
If the answer is your prompt, you are in trouble.
If the answer is your UI, you may also be in trouble.
If the answer is “our prompt and our UI,” congratulations: you may have invented a slightly more attractive commodity.
The real question is what gets better specifically because customers use your product.
That distinction separates an AI feature from an AI moat.
A normal software product creates value when people use it.
A great AI product should create value and create information that makes future value easier to produce.
Think of the difference this way:
Weak loop:
User request → model response → user leaves.
Strong loop:
User request → proprietary context → model/agent action → observed outcome → feedback signal → improved retrieval, routing, workflow, memory, evaluation or automation → better next outcome.
The second system compounds.
That is where defensibility begins.
Moat #1: Proprietary data is overrated. Proprietary feedback loops are not.
“Proprietary data” has become the AI equivalent of “network effects” in startup pitch decks: everyone claims to have it, and remarkably few can explain exactly why it matters.
Having a database does not create a moat.
Having exclusive PDFs does not necessarily create a moat.
Dumping ten years of customer-support tickets into a vector database certainly does not guarantee a moat. Sometimes it guarantees an expensive way to retrieve obsolete refund policies.
The strategically valuable asset is high-signal data generated through usage that tells you whether the AI performed the task correctly.
Consider customer service.
Intercom says its Fin agent resolves an average of 76% of customer queries. Intercom’s description of Fin AI Agent But the more interesting part of the product is not merely the model answering questions. Intercom’s optimization system analyzes conversations Fin could not successfully answer and turns those failures into recommendations about missing content, missing customer data, or missing actions. Intercom’s Fin optimization system (Intercom)
That is much closer to a moat.
The failed interaction becomes training material for the product organization.
If thousands of customers encounter obscure support problems, Intercom can learn which knowledge structures, procedures and integrations improve resolution. The feedback is grounded in real work rather than benchmark theatre.
Salesforce is chasing a similar idea at much larger scale. As of its May 2026 fiscal Q1 report, Salesforce said Agentforce had delivered 3.8 billion “Agentic Work Units”—tasks completed by agents across its platform—and that Agentforce annual recurring revenue had reached $1.2 billion, up 205% year over year. Salesforce Q1 FY2027 results (Salesforce Investor Relations)
Tokens themselves are not particularly defensible.
The resulting graph of:
which task was attempted,
with which customer context,
under which constraints,
using which tools,
whether the action worked,
whether a human corrected it,
and what happened afterward
can be extraordinarily valuable.
That is proprietary outcome data.
The four-question proprietary-data test
Before declaring something a “data moat,” ask:
1. Is the data exclusive?
Could competitors acquire approximately the same information from public sources?
2. Is it generated naturally through product usage?
A dataset that becomes richer every day is much more defensible than something you purchased once.
3. Does it contain outcome signals?
“User asked question X” is useful.
“User asked X, agent recommended Y, user rejected it, human changed Y to Z, and Z resolved the problem” is vastly more useful.
4. Does more data measurably improve the product?
If doubling your dataset barely changes accuracy, the dataset may be an asset, but it is probably not much of a moat.
The ideal AI flywheel therefore isn’t:
More users → more data.
It is:
More usage → more high-quality outcome signals → better decisions → better outcomes → more trusted usage.
The feedback loop is the moat.
The database is just where you keep it.
Moat #2: Personalization matters—but “fine-tune a model for every user” is usually the wrong mental model
One popular theory of AI defensibility goes something like this:
Every user trains their own personalized AI. Eventually their AI knows them so well that switching becomes painful.
The underlying idea is strong.
The implementation is often wrong.
Persistent personalization absolutely can create switching costs. But continuously training a separate foundation-model variant for every individual is usually slower, harder to govern, and less flexible than maintaining a rich user context layer.
For rapidly changing knowledge, retrieval and memory are often better tools.
OpenAI itself distinguishes between techniques such as retrieval-augmented generation, which can add relevant knowledge at inference time, and fine-tuning, which can shape behavior or improve performance on a specialized task. In May 2026, OpenAI even announced that it was winding down its existing self-service fine-tuning platform for new users while continuing other customization approaches. OpenAI’s model-customization and fine-tuning update (OpenAI)
Meanwhile, personalization in products increasingly looks like persistent memory.
OpenAI describes ChatGPT Memory as a way to remember relevant user information across conversations so people do not have to keep explaining the same context. OpenAI’s guide to ChatGPT personalization and memory (OpenAI)
That is strategically interesting because every additional interaction can increase the product’s contextual advantage.
Imagine two executive assistants.
Assistant A knows nothing about you.
Assistant B knows:
your company,
your team,
your preferred writing style,
your calendar patterns,
which projects matter,
which customers are sensitive,
what “the Q3 issue” means,
which meetings you dislike,
how you normally communicate with your CEO,
and that when you say “make this concise,” you mean four sentences rather than fourteen bullets and an inspirational quote from Steve Jobs.
Even if both assistants use the identical underlying model, their usefulness is no longer identical.
Switching away from Assistant B means rebuilding context.
That creates switching cost without deliberately imprisoning the customer.
The best personalization architecture may therefore combine:
Persistent memory + retrieval + preference learning + user feedback + selective model customization.
Fine-tuning still has legitimate uses, especially where companies possess substantial proprietary examples of a specialized task. OpenAI previously described a custom legal model developed with Harvey using the equivalent of roughly 10 billion tokens of domain material; according to OpenAI, the resulting system produced 83% more factual responses in its evaluation and was preferred by attorneys 97% of the time versus GPT-4. (OpenAI)
But that is very different from automatically fine-tuning “BobGPT” because Bob clicked thumbs-up six times last week.
Personalization is a moat.
Fine-tuning is merely one possible implementation detail.
Moat #3: Own the workflow, not merely the chatbot
One of the clearest lessons of 2026 is that the AI assistant itself is migrating into the existing software where work happens.
Microsoft is perhaps the strongest demonstration.
Microsoft 365 Copilot exceeded 30 million paid seats by June 30, 2026. Microsoft FY2026 fourth-quarter results
Why would enterprises pay Microsoft for AI when exceptionally capable general-purpose AI products already exist?
Because Microsoft owns context and workflow.
In an April 2026 earnings call, Satya Nadella said:
“Nearly every task depends on organizational context.”
Microsoft said the Work IQ layer grounding Copilot already spanned more than 17 exabytes of organizational data, including email, documents, meetings, SharePoint sites, roles and communications—and that Copilot-generated conversations and artifacts make that context richer over time. Microsoft FY2026 Q3 earnings discussion of Work IQ(Source)
That is considerably harder to clone than a chat window.
The same pattern explains GitHub Copilot.
By mid-2026 GitHub Copilot had evolved well beyond code completion into agents operating through repositories, pull requests, reviews, issues and actions. Microsoft reported 50 million GitHub Copilot users by FY2026 year-end. (Source)
The interesting moat isn’t that Copilot has access to a specific LLM.
In fact, Microsoft has deliberately moved toward multiple models. Earlier in 2026 it said the majority of GitHub Copilot users were leveraging more than one model. (Microsoft)
That is the point.
The application survives model substitution because the workflow remains.
GitHub owns:
repository history → permissions → branches → pull requests → CI/CD → code review → developer identity → deployment workflow.
The model becomes an interchangeable cognitive engine operating inside a far less interchangeable system.
This suggests an important product strategy rule:
Your AI layer should ideally become more valuable when better third-party models arrive.
If a competitor releases a breakthrough model next month and you can plug it into your system while preserving your customers’ data, context, workflows and feedback loops, excellent.
Their R&D just improved your product.
That is a much more pleasant situation than waking up to discover their new model is your product.
Moat #4: Integrations alone are becoming less defensible
At first glance, integrations look like a perfect AI moat.
Connect your assistant to Jira, Slack, Salesforce, GitHub, Gmail, Google Drive, Dropbox, SAP, Confluence, Workday and whichever enterprise system was apparently designed in 1998 and has been threatening to migrate to the cloud since 2014.
Eventually, surely, nobody can copy you.
Unfortunately, standards are attacking this moat too.
Anthropic introduced the Model Context Protocol in 2024 specifically to standardize how AI applications connect to tools and data. By December 2025 MCP had been contributed to the Linux Foundation’s Agentic AI Foundation and was being supported across major AI ecosystems. Linux Foundation announcement on MCP and the Agentic AI Foundation
Anthropic’s Mike Krieger described MCP as having become:
“the industry standard for connecting AI systems to data and tools.”
The Linux Foundation reported adoption across ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, VS Code and others. (Linux Foundation)
That is great for interoperability.
It is less great if your competitive strategy was “we built the Slack connector.”
So the integration moat is moving upward.
What matters is not simply whether you can access Salesforce.
What matters is whether you understand:
what a particular Salesforce object means,
which records matter to this employee,
which customer is strategically important,
what permissions apply,
which actions are allowed,
what approval chain must run,
which historical actions succeeded,
and whether an agent should update the record automatically or request human review.
The connector becomes infrastructure.
The semantic, permission and workflow layer above the connector becomes the differentiator.
Moat #5: Build a context graph competitors cannot reconstruct overnight
Glean provides one of the clearest examples of this strategy.
Its Enterprise Graph maps relationships among employees, projects, products, customers, processes and content. Glean also maintains personal graphs intended to understand an individual employee’s projects, collaborators, work patterns and preferences. Glean’s Enterprise Graph architecture (Glean)
Notice how different this is from traditional RAG.
Traditional retrieval asks:
Which documents resemble this query?
A richer context system asks:
Who is asking? What are they working on? Which project does this probably refer to? Which source is authoritative? Who has access? Which related customer, team and deadline matter? What actions normally follow?
That difference becomes more important as base-model intelligence rises.
Paradoxically, better models can increase the value of proprietary context.
A mediocre model may fail regardless of the data you feed it.
A brilliant model can exploit subtle contextual relationships.
So as models improve, companies with the richest context layers may gain disproportionately.
The model providers supply reasoning.
The application supplies reality.
That division of labor may define much of the next generation of enterprise AI.
Moat #6: Trust, permissions and evaluation are boring—and therefore valuable
AI founders understandably prefer discussing autonomous agents to discussing audit logs.
Nobody has ever raised a Series A by walking onto the stage and screaming:
“ROLE-BASED ACCESS CONTROL!”
But enterprise AI eventually encounters an inconvenient institution known as the real world.
Models still make mistakes.
Stanford’s 2026 AI Index found that agents on OSWorld, a benchmark involving computer tasks, had improved from roughly 12% accuracy to 66.3%—remarkable progress, but still approximately one failed attempt in three. Stanford 2026 AI agent benchmark data (Stanford HAI)
That makes governance part of the product.
For a sales email, an error may be embarrassing.
For an agent moving money, modifying production infrastructure, approving insurance claims or changing medical records, “the AI got creative” is not an acceptable postmortem.
Defensible systems therefore accumulate infrastructure around:
authorization,
identity,
auditability,
human approval,
confidence thresholds,
rollback,
policy enforcement,
evaluation suites,
domain-specific safety checks,
provenance,
and monitoring.
These capabilities rarely generate viral demo videos.
They do generate procurement approvals.
And once an AI system becomes trusted enough to execute meaningful actions, replacing it becomes significantly harder.
Trust is a switching cost.
Moat #7: Distribution is still a moat, even if VCs find it less exciting than transformers
There is another uncomfortable truth in AI strategy:
Sometimes the best AI company does not win.
The company already sitting in front of the customer does.
Salesforce offers a useful illustration. In Q1 FY2027, more than half of Agentforce and Data 360 bookings came from existing customers. Salesforce’s May 2026 Agentforce results (Salesforce Investor Relations)
This is distribution leverage.
A startup may have a marginally superior agent. Salesforce already has:
customer records,
enterprise contracts,
administrators,
security configuration,
workflows,
sales teams,
procurement approval,
APIs,
partner ecosystems,
and executives who would rather upgrade a contract than conduct another nine-month vendor review.
Microsoft enjoys the same advantage.
This does not mean startups cannot win. It means a startup competing with an incumbent must usually build a much larger product advantage than “our answers are 8% better.”
Startups need asymmetry.
Perhaps they own a previously ignored workflow.
Perhaps they acquire data incumbents cannot.
Perhaps they radically outperform on outcome economics.
Perhaps they create a new distribution channel.
Perhaps they specialize so deeply that the horizontal platform cannot match them.
But ignoring distribution because “AI changes everything” is dangerous.
AI changes a lot.
Procurement departments remain surprisingly resilient.
Moat #8: Move from selling intelligence to selling outcomes
Perhaps the most important commercial shift is from pricing AI according to access toward pricing it according to work accomplished.
Intercom charges for Fin based on successful outcomes, starting at $0.99 for certain resolutions and completed procedures rather than simply charging for raw model tokens. Intercom’s outcome-based Fin pricing (Intercom)
Salesforce has created its “Agentic Work Unit” metric to describe tasks executed by agents.
And when Microsoft reported its FY2026 results, Nadella described the goal as helping customers:
“turn tokens into business results.”
(Source)
That phrase captures where product strategy is going.
Nobody actually wants tokens.
Nobody wakes up thinking, You know what would improve my Thursday? Four million additional tokens.
Customers want:
a support ticket resolved,
a pull request completed,
an invoice reconciled,
a qualified lead,
a report created,
an insurance claim processed,
a meeting prepared,
or a software bug fixed.
The closer your economics are tied to those outcomes, the more proprietary outcome data you collect.
And that creates another loop:
Outcome-based pricing → incentive to improve outcomes → better instrumentation → richer outcome data → better automation → improved economics.
Now we are building a moat.
The AI moats that are probably fake
Product teams should be particularly suspicious of five commonly claimed advantages.
“Our prompt engineering”
Prompts matter enormously to product quality.
They are not generally durable competitive barriers.
Prompt engineering is seasoning, not a castle wall.
“We use Model X”
Unless you have genuinely exclusive access, so does everyone else.
And increasingly, serious products deliberately support multiple models.
“We have RAG”
Congratulations on joining 2024.
Retrieval is architecture, not differentiation.
The differentiation is the proprietary knowledge architecture, ranking signals, permissions, feedback loops and context that make your retrieval better.
“We have lots of integrations”
Useful, yes.
But open standards such as MCP are steadily reducing the cost of reproducing basic connectivity.
“We have proprietary data”
Which data?
How exclusive is it?
Does it improve outcomes?
Does it become more valuable through use?
Can competitors purchase something similar?
If nobody can answer those questions, you may have proprietary storage bills.
A defensibility scorecard for AI product managers
When evaluating an AI roadmap, I would score every major feature on five dimensions.
Question
Weak
Strong
Does usage generate proprietary information?
No
Every interaction produces useful outcome signals
Does the product improve from accumulated context?
Session-only
Persistent user/company context compounds
Does it become embedded in a workflow?
Separate chatbot
Executes inside a system of record/action
Would switching destroy accumulated value?
Easy export and restart
Significant context/workflow rebuilding required
Can competitors reproduce it with the same model?
Weekend prototype
Requires years of data, trust, distribution or workflow history
The objective is not to maximize switching pain.
The objective is to maximize accumulated customer value.
Those are different things.
Artificial lock-in makes customers angry.
Accumulated intelligence makes customers reluctant to leave because the product genuinely understands their work better.
The most defensible architecture may be surprisingly model-agnostic
There is a final implication that AI product leaders should take seriously.
Your architecture should assume that the best model will keep changing.
Stanford reports that frontier model leadership has moved repeatedly among companies and countries. Microsoft now exposes multiple models inside its own products. GitHub users increasingly move among models depending on the task. Glean advertises access to dozens of frontier and open models through its AI gateway. Glean’s multi-model AI Gateway(Stanford HAI)
That implies a modern AI product stack might look something like:
Model layer: replaceable.
Routing layer: proprietary.
Evaluation layer: proprietary.
Context and memory layer: proprietary.
Customer data graph: proprietary.
Workflow and action layer: deeply integrated.
Permissions and governance: accumulated.
Feedback and outcome data: compounding.
Distribution: difficult to reproduce.
Now an OpenAI release, Anthropic release, Gemini breakthrough or open-source leap is not an existential crisis.
It is an upgrade opportunity.
That is exactly where you want to be.
The real moat is the rate at which your product learns
AI has revived an old Silicon Valley temptation: confusing technical novelty with strategic defensibility.
The spectacular capability of foundation models makes that mistake particularly easy.
A brilliant model demo feels like magic.
But competitors can buy magic too.
The more durable question is whether your product develops advantages that competitors cannot obtain simply by increasing their API budget.
The strongest AI products will accumulate four things:
Context: They understand the customer, organization and task better over time.
Feedback: They know what actually worked.
Workflow position: They can act where economically valuable work occurs.
Trust: They have earned permission to perform increasingly consequential actions.
Everything else—including the model itself—should increasingly be treated as replaceable infrastructure.
Stanford reports that AI adoption reached 88% of surveyed organizations in 2025, while generative AI was already in use across at least one business function at a large majority of companies. Stanford’s 2026 AI economy research (Stanford HAI)
So the easy phase is ending.
Putting AI inside software is rapidly becoming table stakes.
The next competition is about whose AI learns fastest from proprietary reality.
That is the moat product teams should be designing.
Not a clever prompt.
Not a shiny chatbot.
Not a dependency on whichever model is winning the benchmark leaderboard this month.
Build the context nobody else has.
Capture the feedback nobody else sees.
Own the workflow where the value is created.
Make your product smarter every time someone uses it.
And if the foundation models become 10 times better and 10 times cheaper next year?
Even better.
Your moat should get wider.